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We prove that quantum computation is polynomially equivalent to classical probabilistic com- 
putation with an oracle for estimating the value of simple sums, quadratically signed weight enu- 
merators. The problem of estimating these sums can be cast in terms of promise problems and 
has two interesting variants. An oracle for the unconstrained variant may be more powerful than 
quantum computation, while an oracle for a more constrained variant is efficiently solvable in the 
one-bit model of quantum computation. Thus, problems involving estimation of quadratically signed 
weight enumerators yield problems in BQP (bounded error quantum polynomial time) that are dis- 
tinct from the ones studied so far, include a canonical BQP complete problem, and can be used to 
define and study complexity classes and their relationships to quantum computation. 



It is widely believed that quantum computers are more efRcient than classical deterministic or probabilistic comput- 
ers. For example, there is an efRcient algorithm for factoring integers on a quantum computer, while no such algorithm 
is known for classical computers [ p^lp^ ]. Unlike numerous other models more efficient than traditional computation, 
quantum computation appears to be robustly implementable using reasonable physical devices [p]J^j5|,|7|,p| . 

To better understand the power of quantum computers, it is desirable to find specific problems to which the 
problem of simulating a quantum computer on a classical computer can be reduced. In principle, such problems 
can be extracted from the representation of the amplitudes of the desired answer of a quantum algorithm as a sum 
over paths of transition amplitudes. (The sum is over all possible evolutions of the computational states consistent 
with the steps of the quantum algorithm.) This representation can be used to prove that quantum computers can be 
simulated on classical computers with exponential overhead in time and polynomial overhead in space |^,^]j4j. The 
resulting problems can be simplified by using the fact that transition amplitudes can be restricted to a small set of 
rational numbers However, these path sums are still too general for use as canonical problems whose solutions 
suffice for efficient simulation of quantum computers. Furthermore, it is not clear how to modify the path sums to 
represent related computational models such as the one-bit model of quantum computation . This model differs 
from standard quantum computation in that the initial state is random except for one quantum bit, and measurement 
is destructive. The goal of this paper is to remedy this situation by relating both the standard and the one-bit model 
of quantum computation to problems of estimating certain sums related to weight generating functions for binary 
codes. Some of these estimation problems can be cast as promise problems with the property that oracles for these 
problems can be used to efficiently predict the answers of quantum algorithms. Conversely, since there are efficient 
quantum algorithms and one-bit quantum algorithms for solving such promise problems, they define a new class of 
problems in BQP that are apparently hard for classical computation. 

Quadratically Signed Weight Enumerators. A general quadratically signed weight enumerator is of the form 



where A and B are be 0-1-matrices with B of dimension n by n and A of dimension m by n. The variable b in 
the summand ranges over 0-1-column vectors of dimension n, denotes the transpose of b, \b\ is the weight of b 
(the number of ones in the vector b), and all calculations involving A, B and b are modulo 2. The absolute value of 
S{A,B,x,y) is bounded by (|a;| -I- In general, one can consider the computational problem of evaluating these 

sums. Here we consider the following cases, which will be related to quantum computation: 

Problem 1 Given that k and I are positive integers, evaluate S{A,B,k,l). 

Problem |l| is in the class [|j . 
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Problem 2 Given that k and I are positive integers and the promise \S{A,B,k,l)\ > (fc^ + Z^)"/^/2, determine the 
sign of S{A, B,k,l). 

The next two problems require that A is square. Let l"wtr(A) denote lower triangular part of A, which is the matrix 
obtained from A by setting to zero all the entries on or above the diagonal. Let diag(A) denote the diagonal matrix 
whose diagonal is the same as that of A. I denotes the identity matrix. For matrices C and D with the same number 
of columns, [C; D] denotes the matrix obtained by placing C above D. 

Problem 3 Given that diag{A) = I, k andl are positive integers, and the promise \S{A, lwtr{A),k,l)\ > (/c^+Z^)"^^/2, 
determine the sign of S{A,lwtr[A),k,l). 

Problem 4 Given that diag{A) = I, k and I are positive integers and the promise \S{[A; A^], lwtr{A), k,l)\ > (fc^ + 
Z2)"/2/2, determine the sign of S{[A;A^],lwtr{A),k,l). 

We will show that Problem || is BQP complete, so that classical probabilistic computation with an oracle for this 
problem is polynomially equivalent to quantum computation. Problem ^ is solvable efficiently using a one-bit quantum 
algorithm. In the last two problems, the integers k and I can be restricted to 4 and 3, respectively, without affecting 
their hardness with respect to polynomial reductions (using classical deterministic algorithms). 

II. MODELS OF QUANTUM COMPUTATION 

An easy-to-use model of quantum computation consists of a classical random access machine (RAM) Q with access 
to any number of addressable quantum bits (qubits) that are initially in the state |0). The qubits can be manipulated 
by one of a finite set of quantum gates and by measurement. This model is called the quantum random access machine 
(QRAM). For introductions to the basic notions of quantum computing, see |jl|,§. 

The basic states of qubit A are denoted by |0)^ and These are elementary ket symbols. The basic states of a 
collection of qubits are obtained by formally multiplying the basic states of each qubit. For example, |0)^|1)^|0)(^ is a 
basic state of qubits A, B and C. We use the convention lOlO)^^^ = |0)a |0)c- Qubit labels are omitted when they 
can be inferred from the context. The (pure) state space of a collection of qubits consists of the unit complex linear 
combinations (called superpositions) of their basic states. 

Quantum gates act on qubits by applying a unitary operator to the current state. An example is the NOT gate, 
which in matrix form is given by the Pauli matrix a^. The NOT gate applied to qubit A is denoted by a^^^"^ and has 
the effect of flipping the binary label associated with A in the basic states. The effect on superpositions is obtained 
by linear extension. 

To describe gates and their effects we can use the bra- ket conventions. In addition to the ket symbols already 
introduced, we introduce hra symbols ^{h\ for qubit X with 6 = or 6 = 1. Formal linear combinations of bra and 
ket symbols can be multiplied using distributivity and associativity rules together with the following: 

1. Bras and kets with different labels commute. 
2- x(a|l^>x = 5aM- 

3. Expressions involving two kets or two bras with the same label next to each other are illegal. 

If is a bra-ket expression, then so is 4)\ which is obtained by conjugating the complex coefficients, reversing the 
order of elementary products and changing kets into bras and vice- versa. For example \{))^ = ^(0|. 
With these conventions, we can write the NOT gate acting on qubit A as 

'^.^ = |0)..(1| + |1)..(0|, (2) 

where is intended to be applied to a state by multiplication on the left. The elementary gates available to a QRAM 
are unitary operators acting on one or two qubits. The operator U is unitary if U^U acts as the identity. Note that 
in the bra-ket notation, there are many ways of writing the identity operator. Examples include 

1 = |0)..(0| + |1),,(1| (3) 
= Y.\^).s....sAb\. (4) 

b 
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The elementary gates to be used here are based on exponentials of products of the Pauli operators and 

a, = -*|0)(l| + i|l)(0| (5) 
a, = |0)(0|-|l)(l|. (6) 

For qubits labeled by 1, . . . ,n, a general product of Pauli operators is denoted by ab^ where b consists of n pairs of 
bits and is defined by 

n 

i=l 

with the conventions (Too = croi = f^xi cii = cr^ and (Tio = a^- The weight of Ub is the number of non-zero pairs of 
bits in b. A rotation by 9 around ab is the operator 

e""""^/^ = cos(6'/2) - i sm{e/2)crb. (8) 

A complete set of one and two qubit gates can be obtained from the set of rotations by ±2 arccos(4/5) around operators 
of weight at most two j^,^,^. A polynomially equivalent model is obtained by allowing such rotations around any 
product of Pauli operators. We adopt this model. 

A general QRAM may at any time measure a qubit and act according to the measurement outcome. Suppose 
the state of the qubits is given by ip. Suppose the QRAM measures qubit A. In bra-ket notation we can expand 
tp = |0)^^o + with -00 and tpi not containing any kets labeled A. Let p = V'oV'o and q = iplipi- Then p and q 

are positive reals with p + q = 1. The effect of the measurement projects the qubits into the state \0)^{l/p)tpo with 
probability p and into the state \l)^{l/q)ipi with probability q. The answer of the measurement is in the former 
case, and 1 in the latter, and the answer is placed into a (classical) bit register. We simplify this model by permitting 
only measurements of qubit 1 and assuming that all the qubits used so far are lost after the measurement. This 
simplified model is polynomially equivalent to the general one with respect to bounded error algorithms for promise 
problems. 

A version of the one-bit model of quantum computation is given by the QIRAM, which differs from the (simplified) 
QRAM only in that the initial state of the qubits has qubit 1 in state |0) and all the other qubits in a state picked 
uniformly at random from the basic states. A measurement of qubit 1 also re- initializes the qubits. Surprisingly, there 
are problems for which no efficient classical algorithm is known and that can be solved efficiently using a QIRAM, 
while QlRAMs are not as powerful as QRAMs with respect to oracles 

III. SIMULATING QUANTUM COMPUTERS 

As described above, both models of quantum computation can be thought of as being based on classical deterministic 
RAMs with access to certain oracles. The input to the oracles is a sequence of quantum gates and the answer is or 1 
with the appropriate probability distribution. A fundamental question is whether a probabilistic RAM can efficiently 
implement these oracles. Note that the output probability distribution in such an implementation can deviate from 
the correct one by 0{e/N), where TV is the total number of oracle calls, without significantly affecting the output of 
an algorithm. 

The problems solved by the oracles can be cast in terms of promise problems. In particular, the following promise 
problems can be solved efficiently by quantum computers and one bit quantum computers, respectively: 

Problem 5 Given a quantum network and the promise that after applying the quantum network to the initial state 
|00 . . .), the probability p that the first qubit is in state |1) satisfies \2p — 1| > 1/2, determine the sign of 2p — 1. 

Problem 6 Given a quantum network and the promise that after applying the quantum network to the initial state 
with the first qubit in state |0) and the others random, the probability p that the first qubit is in state |1) satisfies 
|2p— 1| > 1/2, determine the sign of 2p — 1. 

Theorem 7 A probabilistic RAM with access to an oracle for Problem |^ can efficiently simulate a quantum computer. 

We do not know whether a similar theorem holds for the one-bit model of quantum computation with respect to 
Problem ^. 



3 



Proof. Suppose that we are given a quantum network Q. The goal is to produce a random bit with probabiHty 
distribution close to the output qubit's distribution for Q. The first step is to use an oracle for Problem ||to estimate 
the probability that the output qubit is in state |1). To do so we design new quantum networks Qx,n- Qx,n applies 
Q to {N/tY independent sets of qubits, then uses ancillas to (reversibly) determine whether the fraction of |l)'s in 
the (iV/e)^ output qubits is greater than x or not, placing the answer into its output qubit. The oracle is queried 
for Gx.N- By using binary search on the desired probability can be determined to within 0{e/N) in 0(log(iV/e)) 
queries. The probabilistic RAM then simulates the output of the quantum network by producing a random bit with 
this estimated bias. ■ 



IV. REDUCTION TO QUADRATICALLY SIGNED WEIGHT ENUMERATORS 

For a quantum network t/, let U{Q) be the unitary operator defined by Q. Observe that without loss of generality, 
we can restrict Q to have only real gates H. (Other networks can be simulated by real networks using one ancilla 
qubit to keep track of phases, see Appendix|A|. ) These are gates involving rotations around cr^'s with an odd number 
of factors of the form ay . The gate set is still complete if we assume also that the orientation of the rotation is positive 
if the number of ay is 1 mod(4) and negative otherwise. 

The results and arguments in Q show that Problems || and ^ are equivalent to problems of estimating specific 
coefficients of an operator representation of U{Q). In particular, for networks with real gates only, they correspond 
to the following two problems: 

Problem 8 Promise: |(00 . . .|[/(^)|00 . . .)| > 1/2. Determine the sign o/ (00 . . .|[/(5)|00 . . .) . 

Problem 9 Let n he the number of qubits used by Q. Promise: \-^trU{Q)\ > 1/2. Determine the sign of trU{Q). 

Let G be determined by the sequence of gates Gi, . . . , Gn, so that U{Q) = GnGn-i ■ ■ - Gi. Each gate is of the 
form 



Gfc = ^±z^ab„, (9) 



where b contains an odd number of pairs of the form 11 and the sign (±) depends on the number of ay in ai,^. Let 
\b\y be the number of ay occurring in ab and define ab — (— i)''''''(T6. Then, because of the condition on the signs of 
the rotations, 

Gk^^ + hb,. (10) 

To expand the product of the G^, we need to determine the multiplication rules for the ab- The property that b has 
an odd number of pairs of the form 11 is defined by b^Bb = 1, where B is block diagonal with two- by- two blocks 
given by 

B.= {ll)- (11) 

Direct verification shows that the multiplication rules are given by 

ab,i^b, = i-lf''^b^+b,, (12) 
where the sum in the subscript is bit-by-bit, modulo two. U{G) can now be expanded as follows: 

1 

U{G) ^Y[Gk (13) 

k=N 
1 

= n(4 + 3^fcJ/5 (14) 

k=N 

= ^^(_l)-"lwtr(H-i3H)a4|a|3JV-|a|~^^^ (^5) 
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The last step requires distributing the product over the sum and using the multiphcation rules for the ab operators. 
H is the matrix whose columns are the bk- The sum is over all 0-1 column vectors a of dimension N. The bits 
of the vector a correspond to which of the two terms of each sum in the product are chosen to get a summand of 
the expansion. The first bit of a determines the term of the factor Gi, and so on. Note that every matrix H of 
dimension 2n by TV with the property that diag{H^BH) = I can occur in this expression. The coefficients of U{g) 
to be estimated in Problems || and || are 



(00...|[/(^)|00...) = ^ J2 (-l)«"l^tr(H-SH)a4|a|3JV-|a| (^g^ 

a:BHa=a 



5^ 

a:Ha=0 



Here the condition BHa = means that aHa has no or ay factors. 

It remains to obtain the simpler forms of Problems ^ and ^. Let Hq and Hi be the two n by matrices obtained 
from the even and the odd rows of H, respectively (starting the count at zero, so that the first row is considered 
even). The above sums are then equivalent to 



{00...\U{g)\00...) = (_l)anwtr(ff„^ffi)«4kl3A'-kl (18) 

a:Hi a—0 

l.trU{g)^^ J2 (-l)-"lwtr(i/o"J^i)-4l-l3JV-|a|^ (^g) 



0" 

a: Hi a—Q,Hoa—0 



Any pair of matrices Hq and Hi with the property that diag(i?Ji?i) = / is possible in these sums. To show that the 
sums of Problems ^ and ^ are of this form, consider first the case k = A and I — 3. The two sums can then be written 

as 

^ (_l)a^lwtr(C)a4lal3Ar-|a| (20) 
a:Ca=0 

^_lY'^hfftv(C)a^\a\^N-\a\_ (21) 

a:Ca=0,C^a=0 

In the former case, let Hq = I and Hi — C, to see that it is an instance of Sum (|l^. (The factor of 5^ is properly 
taken care of by the conditions in the promise.) In the latter case, observe that one can write C — XY^ with X 
and Y rectangular matrices with independent columns. This can be done by first using Gaussian elimination to 
write UCV"^ = Ik, where U and V are invertible and Ik is a partial identity matrix with k ones, then using such a 
decomposition for Ik ■ To see that this sum is in fact an instance of Sum (^, let Hq = X'^ and Hi = Y'^ and observe 
that HqHiu = iff TJia = and similarly for Hj Hq. 

For other k and I, use the above reductions to get sums like those of (Esh and (Eot), but with k and I substituted 



for the numbers 4 and 3, respectively, and \/W^+P substituted for the divisor 5. These sums correspond to sums 
involving gates with different rotation angles. By universality, these gates can be approximated to within 0{e/N) 
using the standard ones with polylog(iV/ e) overhead in gates [p^J^ . There is a classical algorithm that computes such 
approximations efhciently. The resulting gate network can be turned back into a sum of the desired form. 

To see that Sum ( p^ ) can be cast in the form required by Problem ^ requires more work. Let Hq and Hi be as in 
Sum (|l^). If Hq has independent rows, then the constraint Hia = is equivalent to HqHig = 0, so the sum is of the 
desired form. If not, it is necessary to modify Hq so that it has full rank without changing the value of the sum. 

Lemma 10 There exists a full rank H2 such that lwtr[H2 Hi) = lwtr{H^ Hi) and diag{H2 Hi) = I. 

Proof. Consider the first n columns of Hq and Hi, labeled ci, . . . , c„ and di, . . . ,dn respectively. To obtain H2, 
the Ci are replaced by independent c^. In order for the desired equality to hold, we need d^c'j — djcj for i < j. The 
desired c'j can be constructed starting with c^. Let be any solution to dfc'^ = dfcn for all i < n. Such a solution 
exists and is non-zero because djc„ = 1. Suppose c^, c'^^i, . . . , c'k+i have been constructed. The set of solutions to 
dfx = dfck for i < fc is an afhne subspace not containing of dimension at least n — k. Its intersection with the 
complement of the span of the c^,c^_]^, . . . ,c'|^_^_l is therefore not empty. Let c'j, be an element of this intersection. 
Proceed until c'l has been obtained. The vectors constructed by this method satisfy the desired conditions. ■ 

For the matrix shown to exist by this lemma, 
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a:Hia—0 a:Hia—0 

Thus, the constraint in the sum can be replaced by H2 Hia = to obtain a sum of the desired form. We have proved 
the following: 

Theorem 11 Problem^ is polynomially equivalent to Problem^. 

Corollary 12 Probabilistic RAMs with an oracle for Problem |^ are polynomially equivalent to quantum computers. 
Corollary 13 Problem^ is complete for BQP. 

Theorem 14 Problem ^ can be solved efficiently by one-bit quantum computers. 

It is an open problem to determine whether the converse of Theorem ^ holds and to determine the relationships 
between the various promise problems suggested in the Introduction. Note that it is possible to simulate one-bit 
quantum computers given access to oracles for Problem^, if the coefficient 1/2 in the bound in the promise is replaced 
by 1/X, with X given as an input. (X should be given as a unary number to maintain canonical size/complexity 
relationships.) 

V. CONCLUSION 

We have shown that the problem of simulating a quantum algorithm on a classical computer is equivalent to the 
difficulty of estimating certain combinatorial sums given by the quadratically signed weight enumerators. The prob- 
lem of approximating these sum includes a new set of apparently difficult problems solvable efficiently by quantum 
computers. The class of known problems of this type is still sparse. Except for the ones proposed here, they are 
generally related to finding periodicities in functions or inferring properties of eigenvalues of unitary operators. Shor's 
factoring and discrete logarithm algorithms are of this type . The factoring and discrete logarithm problems have 
the advantage of not requiring a potentially difficult to verify promise. On the other hand, promise problems are 
a natural framework to use for both probabilistic and quantum computation and abstract the much more economi- 
cally significant statistical inference problems underlying many practical applications. Our work demonstrates that 
quadratically signed weight enumerator problems are both simple to state and have sufficient fiexibility to represent 
the capabilities of both quantum computers and one-bit quantum computers. There are variants that appear to be 
hard, perhaps even for quantum computers, and others that may be easier than one-bit quantum computation but 
hard for classical computation. As a result, the investigation of this class of problems will contribute toward a better 
understanding of classical and quantum complexity classes. 
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APPENDIX A: REAL GATES ARE EQUIVALENT TO COMPLEX GATES 

Let Q he a. gate network consisting of the gates G^v, . . . ,Gi. Introduce a new qubit, labeled 0, to represent the 
complex phase by the real orthogonal map 

R:{a\Q),+p\lUb)^{a + im- (Al) 

Define G'^ — di{Gk) — io'j,^"-'3(Gfe). Then the G'^ are real orthogonal and define a new gate network Q' . Note that 
each G'j, can be efficiently approximated using the elementary real gates. The unitary operator defined by Q' satisfies 

u{g') = n{u{g)) - iay^°^^{u{g)), (A2) 

and U{g) — RU{Q')R^^ . These relationships can be used to simulate any network by a real network. 



7 



